FBI Announces Arrest in Connection with ShinyHunters FBI Systems Breach
FBI Director Kash Patel announced on October 9, 2026, that federal agents had arrested another suspected member of the ShinyHunters extortion group in connection with the recent breach of FBI systems. The arrest was made in Pennsylvania, and the suspect is a Canadian citizen believed to be a primary co-conspirator in the intrusion. Patel disclosed no further details about the suspect’s identity or the specific charges filed, but confirmed the individual is linked to the compromise of FBI systems that occurred on a platform managed by a third-party vendor.
"Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent http://FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,"
— Kash Patel, FBI Director, via X (formerly Twitter)
Patel emphasized that this arrest is part of an ongoing effort to dismantle the ShinyHunters network, pursue leads, and act swiftly against the group. He noted it is the latest in a series of actions taken by the FBI in just days, underscoring the urgency of the response.
Details of the FBI Systems Breach and Data Exposure
According to prior disclosures by ShinyHunters to BleepingComputer in September, the group gained access to FBI systems by exploiting an alleged zero-day vulnerability in Oracle PeopleSoft software. After initial intrusion, the threat actors moved laterally into the FBI’s AWS GovCloud infrastructure, which hosts sensitive government workloads.
The attackers claimed to have exfiltrated between 2TB and 3TB of data, including:
- Information on current and former FBI employees
- Job applicant records
- Medical and psychiatric records
- Internal service records
- Home addresses and Social Security numbers
- Details about employees’ family members
Data samples shared with BleepingComputer and other media outlets confirmed the exposure of this personal and sensitive information. An internal FBI memo, later reported by The New York Times, indicated the agency initially assumed the breach had affected all employees.
The FBI has since attributed the breach’s root cause to a third-party contractor-managed platform that failed to apply a critical security update.
Ongoing Law Enforcement Pressure on ShinyHunters
This arrest follows a broader campaign by U.S. and international authorities to disrupt ShinyHunters. On September 15, 2026, Dutch police arrested Pepijn van der Stap, a 24-year-old from Amsterdam known online as "Umbreon," as part of the same investigation. ShinyHunters denied any affiliation with van der Stap, stating publicly that "that individual has no association with us. Frankly, we are laughing."
Shortly after, the FBI’s Cyber Division Assistant Director Brett Leatherman issued an unusual public warning, urging ShinyHunters members to surrender:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."
Days after van der Stap’s arrest, a suspected ShinyHunters member known online as "Rey" — identified as Saif al-Din Khader — was detained in Jordan and began cooperating with the FBI and international law enforcement, according to Reuters. Around the same time, another alleged affiliate with direct knowledge of the FBI hack shut down an online messaging account, and the group’s data leak site went offline.
A new leak site later emerged, suggesting some operational capacity remains. The group’s main representative, who had regularly communicated with BleepingComputer and possessed deep knowledge of ShinyHunters’ activities over two years, stopped responding on Telegram and had their account deleted. It remains unclear whether this silence is connected to any of the recent arrests.
About ShinyHunters: Tactics, History, and Ongoing Threat
ShinyHunters is an extortion group active since at least 2018, known for stealing data from web applications and cloud-based SaaS platforms, then threatening to leak it unless a ransom is paid. Over the past two years, the group has intensified its campaigns, targeting organizations worldwide.
Recent activity includes breaches of Salesforce and other SaaS environments, often initiated by compromising third-party integration providers to steal authentication tokens. These tokens allow attackers to pivot into connected systems like Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, and Dropbox.
The group has also employed voice phishing (vishing) and device code vishing tactics to steal SSO credentials from Okta, Microsoft, and Google, impersonating IT support to trick employees into revealing MFA codes and access tokens.
Notable past incidents include a major data theft against Instructure Canvas in May, which caused widespread outages. Instructure later reached an agreement with the threat actors to prevent the publication of stolen data. ShinyHunters has also operated as an extortion-as-a-service provider, assisting other cybercriminals in monetizing breaches at organizations such as PowerSchool and in incidents tied to the Snowflake data-theft attacks and the Breached v2 forum.
Despite multiple arrests over the years — including those related to Snowflake, PowerSchool, and the Breached v2 forum — cybercriminals continue to operate under the ShinyHunters name, conducting data theft and extortion globally.
Director Patel concluded by affirming the FBI’s commitment: "We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate."
Source: BleepingComputer